[Full-Disclosure] Lycos HTMLGear Guestbook Script Injection Vulnerability
mattmurphy at kc.rr.com
Sat Sep 14 23:13:13 BST 2002
Lycos offers several advanced web applications through a service called
HTMLGear. Among the services offered are guestbooks. A vulnerability
exists in the Lycos guestbook that could enable someone to launch an attack
against visitors whose browsers supported inline CSS (IE, for example).
By specifying an e-mail address/web page URL like the following:
guestbook also allow a typical IMG attack:
This will yield the same results in many cases.
Full-Disclosure is hosted and sponsored by Secunia.